A bound token, copied, is refused where the broker checks its key.

The phone and desktop clients register a dedicated software key for binding, kept in the device's secure store; it is not the key that approves sign-ins. When binding is enforced, the token is bound only when the client proves its key as the token is issued. The client sends a proof made by its key, and the broker checks that the key belongs to one of the signed-in person's enrolled devices. The token record then keeps the key's thumbprint: a bound token names only one key.

After that, the client signs a fresh proof wherever a proof is asked for. A proof is a short signed token carrying the method and URL of the request, the time and a unique id. The broker accepts a proof within 120 seconds of its time, accepts each id once, and refuses a proof made for another method or URL.

Where the check runs, a bound token sent without a proof from its own key is refused with HTTP 401. That includes a valid, correctly signed proof made by another device's key: the key is not the one the token names. A proof captured on the way cannot be used again, because its id is spent and it names one method and URL.

The broker checks the proof on its own token and API calls, not on every path; the technical detail below lists where.

In the lab your browser makes a key that the page can sign with but cannot read out. Take a bound token and try it from another machine. The lab uses a demonstration account.